Seeing a weird extra create parameter (extra info) from a Windows Server 2008R2 or Windows Server 2012 CreateFile rquests

Richard Sharpe realrichardsharpe at
Sat Oct 4 12:13:17 MDT 2014

On Sat, Oct 4, 2014 at 10:56 AM, Richard Sharpe
<realrichardsharpe at> wrote:
> Hi folks,
> I have a couple of captures that contain something like 168 bytes of
> garbage at the end of a Create request that contains the following
> string:
> \x9c\xcb\xcf\x9e\x04\xc1\xe6C\x98\x0e\x15\x8d\xa1\xf6\xec\x83
> Wireshark thinks it is another Extra Info field.
> I wonder what the new MS tool will make of it.
> Has anyone else seen these?

Hmmm, this is what it is:

Richard Sharpe

More information about the samba-technical mailing list